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Abstract 

There is a rich recent literature on how to assist secure communication between a single transmitter and receiver 

. . - , at the physical layer of wireless networks through techniques such as cooperative jamming. In this paper, we consider 

f^ ■ how these single-hop physical layer security techniques can be extended to multi-hop wireless networks and show 

^-^ I how to augment physical layer security techniques with higher layer network mechanisms such as coding and 

p^ ■ routing. Specifically, we consider the secure minimum energy routing problem, in which the objective is to compute 

. I a minimum energy path between two network nodes subject to constraints on the end-to-end communication secrecy 

^ i' and goodput over the path. This problem is formulated as a constrained optimization of transmission power and 

•^ I link selection, which is proved to be NP-hard. Nevertheless, we show that efficient algorithms exist to compute both 

exact and approximate solutions for the problem. In particular, we develop an exact solution of pseudo-polynomial 

complexity, as well as an e-optimal approximation of polynomial complexity. Simulation results are also provided 

I— !■ to show the utility of our algorithms and quantify their energy savings compared to a combination of (standard) 

f^ I security-agnostic minimum energy routing and physical layer security. In the simulated scenarios, we observe that, by 

^^ ■ jointly optimizing link selection at the network layer and cooperative jamming at the physical layer, our algorithms 

'^ I reduce the network energy consumption by half. 

Index Terms 

^ . Wireless security, minimum energy routing, cooperative jamming. 

00 ■ 

\Q I I. Introduction 

^ ' Protecting the secrecy of user messages has become a major concern in modem communication networks. Due 
^ to the propagation properties of the wireless medium, wireless networks can potentially make the problem more 
~^ . challenging by allowing an eavesdropper to have relatively easy access to the transmitted message if countermeasures 
are not employed. Our goal is to provide everlasting security in this wireless environment; that is, we will consider 
methods that will prevent an eavesdropper from ever decoding a transmitted message - even if the eavesdropper has 
the capabiUty to record the signal and attempt decryption over many years (or decades). There are two different 
classes of security techniques of interest here: cryptographic approaches based on computational complexity, and 
C^ information-theoretic approaches that attempt to obtain perfect secrecy. Both have advantages and disadvantages 
for the desired everlasting security in the wireless environment. 

The traditional solution to providing security in a wireless environment is the cryptographic approach: assume 
that the eavesdropper will get the transmitted signal without distortion, but the desired recipient who shares a 
key with the transmitter is able to decode the message easily, while the eavesdropper lacking the key must solve 
a hard problem that is beyond her/his computational capabilities |1|. Since the eavesdropper is assumed to get 
the transmitted signal without distortion, cryptography addresses the key challenge in the wireless environment 
of thwarting an eavesdropper very near the transmitter. However, such an approach faces the concern that the 
eavesdropper can store the signal, and, then, with later advances in computational capabilities or by breaking the 
encryption scheme, obtain the message. The desire for everlasting security then motivates adding countermeasures 
at the physical layer that inhibit even the recording of the encrypted message by the eavesdropper that combine 
with cryptography to facilitate a defense-in-depth approach IJl. 

In the information-theoretic approach to obtain perfect secrecy f3l, the goal is to guarantee that the eavesdroppers 
can never extract information from the message, regardless of their computational capability. Wyner [4| and 
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succeeding authors ||5l, ||6] showed that perfect secrecy is possible if the channel conditions between the transmitter 
and receiver were favorable relative to the channel conditions between the transmitter and eavesdropper. In this 
so-called wiretap channel, perfect secrecy at a positive rate with no pre-shared key is possible [4|. This clearly 
satisfies the requirement for everlasting secrecy, but it relies on favorable channel conditions that are difficult (if 
not impossible) to guarantee in a wireless environment. Hence, information-theoretic secrecy requires a network 
design which inhibits reception at the eavesdropper while supporting reception at the desired recipient. 

Our work supports both a cryptographic (computational) approach or information-theoretic approach. Per above, it 
is advantageous in either case to seek or create conditions so as to inconvenience reception at eavesdropper(s) while 
facilitating communication of the legitimate system nodes. This has been actively considered in the literature on the 
physical layer of wireless networks over the last decade, with approaches based on both opportunism [7|, [8| and 
active channel manipulation |[9l, ifTOl being employed. Most of these works have arisen in the information-theoretic 
community and considered small networks consisting of a source, destination, eavesdropper, and perhaps a relay 
node(s) |[8ll- llT3l . More recently, there has been the active consideration of large networks with the introduction 
of the secrecy graph to consider secure connectivity [T4l- [|T6ll and a number of approaches to throughput scaling 
versus security tradeoffs [17|-[19J. Hence, whereas there has been a significant consideration of small single- and 
two-hop networks and asymptotically large multi-hop networks, there has been almost no consideration of the 
practical multi-hop networks that lie between those two extremes. It is this large and important gap that this paper 
fills. 

Consider a network where system nodes communicate with each other wirelessly, possibly over multiple hops, 
such as in wireless mesh networks and ad hoc networks. A set of eavesdroppers try to passively listen to communica- 
tions among legitimate network nodes. To prevent the eavesdroppers from successfully capturing communications 
between legitimate nodes, mechanisms to thwart such are employed at the physical layer of the network. Two 
nodes that wish to communicate securely may need to do so over multiple hops in order to thwart eavesdroppers 
or simply because the nodes are not within the reach of each other While we make no argument about the 
optimality or practicality of any specific physical layer security mechanism, for the sake of concreteness, we 
focus on cooperative jamming, which has received considerable attention fO^-fOl, f20l. In cooperative jamming, 
whenever a node transmits a message, a number of cooperative nodes, called jammers, help the node conceal its 
message by transmitting a carefully chosen signal to raise the background noise level and degrade the eavesdropping 
channels. Because our general philosophy applies to any physical layer approach, the framework can be extended 
to include other forms of physical layer security. However, some of the attractive features of cooperative jamming 
that motivated us to study this technique include: 

1) Opportunistic techniques Q, ||8] that exploit the time- varying wireless channel may suffer from excessive 
delays depending on the rate of channel fluctuations. For applications that require security without an excessive 
delay, active channel manipulation such as cooperative jamming should be adopted. The price to be paid, in 
this case, is the increased interference due to jamming. 

2) Multi-antenna systems can also be used to jam eavesdroppers ||9], ETI . However, the use of multiple antennas 
on every wireless device may not be feasible due to cost and size {e.g., wireless sensors). Cooperative jamming 
is a distributed alternative to multi-antenna systems. 

3) Node cooperation, while requiring a more complex physical layer, is incorporated in commercial wireless 
technologies such as LTE. Thus, we envision that cooperative jamming can be implemented in practice, as 
was demonstrated in a limited form (single jammer) in li221 . 

4) Anonymous wireless communication is a challenging problem. Cooperative jamming can potentially be uti- 
Uzed for wireless anonymous communication, as it creates confusion for wireless localization techniques [23 1. 

In this general case, the main questions are: (1) how to choose the intermediate nodes that form a multi-hop path 
from the source node to the destination node, and (2) how to configure each hop at the physical layer with respect 
to the security and throughput constraints of the path. Specifically, the problem we consider in this paper is how to 
find a minimum cost path between a source and destination node in the network, while guaranteeing a pre-specified 
lower bound on the end-to-end secrecy and goodput of the path. The cost of a path can be defined in terms of 
various system parameters. In a wireless network, transmission power is a critical factor affecting the throughput and 
lifetime of the network. While increasing the transmission power results in increased link throughput, excessive 
power actually results in high levels of interference, hence reducing the network throughput due to inefficient 



spacial reuse. With cooperative jamming at the physical layer, transmission power is even more important due to 
the additional interference caused by jamming signals if they need to be employed. Thus, in this work, we consider 
the amount of end-to-end transmission power as the cost of a path with the objective of finding secure paths that 
consume the least amount of energy. In turn, such paths, by minimizing interference in the network, result in higher 
throughput. Note that solutions employing power only at the nodes transmitting the messages (and no cooperative 
jamming) are part of the space over which the optimization will be performed; thus, if it is more efficient to not 
employ cooperative jamming, such a solution will be revealed by our algorithms. 

While it might seem that physical layer security techniques can be extended to multi-hop networks by imple- 
menting them on a hop-by-hop basis, in general, such extensions sacrifice performance or are not feasible. The 
eavesdropping probability on a link is a function of the power allocation on that link. A hop-by-hop implementation 
is unable to determine the optimal eavesdropping probability and consequently power allocation for each link in 
order to satisfy the end-to-end constraints (i.e., the chicken-egg problem). Moreover, a hop-by-hop approach overlaid 
on a shortest path routing algorithm might pay an enormous penalty to mitigate eavesdroppers on some links {e.g., 
by routing through a node with one or more links, that, because of system geometry, are very vulnerable to nearby 
eavesdroppers). A routing algorithm that is designed in conjunction with physical layer security can selectively 
employ links that are easier to secure when it is power-efficient to do so and, in such a way, minimize the impact 
of the security constraint on end-to-end throughput. 

Our main contributions can be summarized as follows: 

• We foiTnulate the secure minimum energy routing problem with end-to-end security and goodput constraints 
as a constrained optimization of transmission power at the physical layer and link selection at the network 
layer. 

• We prove that the secure minimum energy routing problem is NP-hard, and develop exact and e-approximate 
solutions of, respectively, pseudo-polynomial and fully-polynomial time complexity for the problem. 

• We show how cooperative jamming can be used to establish a secure link between two nodes in the presence 
of multiple eavesdroppers or probabilistic information about potential eavesdropping locations by utilizing 
random linear coding at the network layer. 

• We provide simulation results that demonstrate the significant energy savings of our algorithms compared to 
the combination of security-agnostic minimum energy routing and physical layer security. 

The rest of the paper is organized as follows. Our system model is described in Section JIl The optimal link and 
path cost are analyzed in Sections HID and [TVl Our routing algorithms are presented in Section fV] Simulation results 
are discussed in Section |Vl] Section IVlI] presents an overview of some related work, while Section fVIIII concludes 
the paper. 

II. System Model and Assumptions 

Consider a wireless network with arbitrarily distributed nodes. We assume that each node (legitimate or eaves- 
dropper) is equipped with a single omni-directional antenna. A i^-hop route H between a source and a destination in 
the network is a sequence of K links connecting the source to the destination^ We use the notation H = {£i, . . . ,£k) 
to refer to a route that is formed by K links ii to Ik. ^ link ^^ G n is formed between two nodes S^ and Dj. on 
route n. We assume that every link ik is exposed to a set of (potential) eavesdroppers denoted by £k. Whenever 
5fc transmits a message to Dj^, a set of trusted nodes, called jammers, cooperate with Sk to conceal its message 
from the eavesdroppers in £k by jamming S^s signal at the eavesdroppers. The set of the jammers cooperating 
with Sk to conceal its transmissions from S^ is denoted by J7fe = { Ji . . . , Jij^i}, where |^| denotes the cardinality 
of set A. The set of jammers is potentially different for different links. Throughout the paper, we use the notation 
{Sk,Dk,£k,Jk) to identify link 4. 

In the following subsections, we describe the models considered in this paper for the wireless channel, eaves- 
droppers, physical-layer security and end-to-end routing. For notational simplicity, we may drop the link index k 
whenever there is no ambiguity. 

'Terms "path" and "route" are used interchangeably throughout the paper. 



A. Wireless Channel Model 

Consider the discrete-time equivalent model for a transmission from node S to node D. Let xs be the normaUzed 
(unit-power) symbol stream to be transmitted by S, and let yr, be the received signal at node D. We assume 
that transmitter S is able to control its power Pg in arbitrarily small steps, up to some maximum power Pmax- 
Let ud denote the receiver noise at D, where n/) is assumed to be a complex Gaussian random variable with 
E Hn/jpl = A^'o- The received signal at D is expressed as 



VD = VPshs,DXs + nD, (1) 

where hs^o is the complex channel gain between S and D. The channel gain is modeled as hs^D = |^5,D|e^^°, 
where \hs,D\ is the channel gain magnitude and 9s,d is the uniform phase. We assume a non line-of-sight 
environment, implying that |/is,D| has a Rayleigh distribution, and that E[|/i5^£)p] = 1/dfg^, where ds^o is the 
distance between nodes S and D, and a is the path-loss exponent (typically between 2 and 6). This is the standard 
narrowband fading channel model employed in the physical layer literature Il24l . ||25l . 

B. Adversary Model 

We limit our attention to passive eavesdroppers as in prior work ||9]|- ||T3]| . ll20l . Although there are other forms 
of adversarial behavior, their consideration is beyond the scope of this paper. 

While the literature on physical layer security often assumes not only eavesdropper locations but also either perfect 
{e.g., |10|) or imperfect {e.g., ll20l ) knowledge at the transmitters and jammers of the complex channel gains of 
the eavesdropping channels {i.e., availability of instantaneous eavesdropper channel state information (CSI)), we 
consider the more realistic scenario, in which CSI for eavesdropping channels is not available. In addition, our 
model requires only the knowledge of potential eavesdropping locations in the network, yet we show that it provides 
guaranteed security by employing coding in conjunction with cooperative jamming. 

Specifically, we assume that each link ^^ is subject to potential eavesdropping from a set of locations denoted by 
£k = {-El, ... jE'i^-j^i}, where the probability of eavesdropping from location £'j is given by p(£'j) for < p{Ei)< 1. 
This is a considerably general model that can be used to represent a wide range of eavesdropping scenariosQ For 
example, setting all p(£'j)'s to 1 for a link models multiple eavesdroppers for that link. Other examples include, 
for example, military scenarios where the locations of enemy installations are known, or wireless networks where 
a malicious user(s) has been detected. In general, for any given link, there is only a limited region around the link 
that can be exploited for eavesdropping. By dividing the effective eavesdropping region to a few smaller areas [26 1, 
one can compute the most effective eavesdropping location within each area, and consequently, construct the set 
of eavesdropping locations for that link. 

C. Physical Layer Security Model 

Consider a secure link formed between source S and receiver D with the help of jammers J'. For the moment, 
we assume that cooperative jamming is implemented at the physical layer to deal with a single eavesdropper E 
located at a fixed position. Later, in Section Hill we show how this physical layer primitive can be used to provide 
security against multiple eavesdroppers or unknown eavesdropping locations. 

When node S transmits a message, there are multiple ways in which cooperative jamming by system nodes can 
be exploited, ranging from relatively simple noncoherent techniques to sophisticated beamforming techniques [27 1. 
Since the implementation of beamforming in other contexts, with the same challenges of synchronization in the 
wireless environment, is advancing rapidly ||28l . ||29l . we assume that the jammers cooperatively beamform a 
common artificial noise signal z to the receiver in such a way that their signals cancel out at the receiver [30 1. The 
noise signal z is transmitted in the null space of the channel vector h/) = [hj^^D, hj^^D, . . . , /iJ|^|,d]^ where, /ij;,d 
denotes the channel gain between jammer Jj and destination D and A^ denotes the conjugate transpose of vector 
A. Thus, the signal transmitted by the jammers can be expressed as sj = h^ z, where h^ is a vector chosen in the 
null space of h.£). It follows that the total transmission power of the jammers is given by Pj =\\ h^ |p. Assuming 

^Although our model cannot be applied to every possible scenario, it is more general compared to the models in the literature on physical 
layer security (see ||9l- l|13l . 1201 . and references therein). 



that the source node transmits with power Ps, the signals received at the destination and the eavesdropper are given 
by 



VD = VPshs,DXs +nD, 

VE = \/Ps hs,E xs + h^h^z + ue, 

where, h^; = [hj^^E, hj^^E, • • • , ^j|^|,£;]^ represents the channel gain vector between the jammers and the eaves- 
dropper, and ud and ue denote the complex Gaussian noise at the destination and eavesdropper, respectively, with 
E[|nD|2] =E[\nE\^] = N^. 

Although the jammers try to prevent the eavesdropper from successfully receiving the message, there is still some 
probability that the eavesdropper actually obtains the message due to the fact that the channel to the eavesdropper 
is unknown in our model, i.e., Yie and hs^E are unknown. Recalling that the signal-to-interference -plus-noise 
ratio (SINR) at the destination is controlled via power control, let je denote the minimum required SINR at the 
eavesdropper in order to violate the security constraints of the protocol (e.g. for the cryptographic case, the SINR 
above which the eavesdropper can record a meaningful version of the transmitted signal; in the information-theoretic 
case, the SINR above which, for a given wire-tap code, the equivocation does not equal the entropy of the message.) 
Let SINR^ denote the SINR at the eavesdropper. We have 



'{SINR^>7i.} = P{ ^J-i;-!:.,^ >7i.] 
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where Eh^ means expectation with respect to channel gain vector h^;. Using the results on quadratic forms E 
Eq. 14] to calculate the expectation, it is obtained that (Iat is the identity matrix of size N) 

P{SINRi5>7s} < ^ 
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where the final expression is derived from Sylvester's determinant theorem: 

det{Im + AB) = det(I„ + BA), 



aT. 



for A and B being m x n and n x m matrices, respectively, and the fact that Pj = hj^ h^ (see (1311)). 

In the remainder of the paper, we use dD in equality form to compute the eavesdropping probability for a given 
jamming power Pj. While this results in a (slightly) conservative power allocation, it is sufficient to satisfy the 
security requirement of each link. 

D. Routing Model 

Consider a i^-hop route 11 = {ii, . . . ,£k) between a legitimate source and destination in the network. Let C 
denote the set of all possible routes between the source and destination. Let C(n) denote the cost of route 11, where 
the cost of a route is defined as the summation of the costs of the links forming the route. With slight abuse of the 
notation, we use C(ik) to denote the cost of link £k as well. The secure routing problem is then defined as follows. 

SMER: Secure Minimum Energy Routing Problem 

Consider a wireless network and a set of eavesdroppers distributed in the network. Given a source and destination, 
find a minimum energy path 11* between the source and destination subject to constraints vr and A on the end-to-end 
successful eavesdropping probability and goodput on the path respectively. 



Let A(n) and X{ik) denote, respectively, the goodput of path 11 and Unk if^ G 11. Then A(n) can be expressed 
as 

A(n) = min A(4) • 

Since goodput of a link is an increasing function of the transmission power of the transmitter of that Unk, a 
necessary condition for minimizing power over the path 11 is given by X{ik) = A, for all £k G n, i.e., all links 
should just achieve the minimum goodput A. Thus, our power allocation scheme (see Section HID ) establishes links 
that achieve exactly the minimum required goodput A. Consequently, the constraint on the end-to-end goodput is 
satisfied by any path in the network, and hence does not need to be explicitly considered when solving SMER. As 
such, SMER can be formally described by the following optimization problem: 



n* = argmin > C(ik) 



4 en (5) 

s.t. P {eavesdropping on route 11} < vr, 

for some pre-specified vr (0 < vr < 1). The constraint on the route eavesdropping probability in the above 
optimization problem can be expressed in terms of the eavesdropping probability on individual links £f^ that form 
the route 11, as Yii (=n(l ~ ''^k) > 1 — vr, where Tr^ (0 < nk < 1) denotes the successful eavesdropping probability 
on link i^. We use the following result to convert the above inequality constraint to an equality constraint in the 
routing problem <^. 

Lemma 1: The cost of route 11 is a monotonically increasing function of Yl^ gj^(l — tt;^.). 

Proof: Consider a path U between the source and destination nodes. Define the end-to-end secrecy of path 11, 
denoted by a; (11), as follows: 

a;(n) = Y[ Uk, (6) 

4 en 

where w^ = (1 — vr^). 

First, we show that the link cost C(£fc) is a monotonically increasing function of the the link secrecy c<jj, for every 

(k) (k) 

link ik G n. Let P^ and P) denote the source and jamming powers allocated to the link ik, respectively. In 
Section |III1 we show that: (i) P^ is a constant for a given link independent of the link secrecy, and (ii) P} is a 
function of the link secrecy and is given by 

p(fc) _ ^fc .r.. 

1-UJk 

(k) (k) 

where c^ is some constant independent of oj^. Thus, for a fixed link l^^ the link cost C{ik) = Pg + Pj depends 
on uik only through the jamming power Pj ' . Taking the derivative on the link cost with respect to cj^ results in 
the following relation: 

/-C(4) = cfc- ^ >0, (8) 

indicating that the link cost is an increasing function of the link secrecy uj^- 

Let C*(n) and C(n) denote the optimal cost of the path U computed by solving the optimization problem (IT4] |. 
with equality and inequality constraints, respectively. Furthermore, let CL!*(n) and a;(n) denote the corresponding 
end-to-end path secrecies. We present a proof of the lemma based on contradiction by assuming that the optimal 
path cost with the inequality constraint is less than that with the equality constraint. That is, we assume that 

c(n)<c*(n), (9) 

while, 

to{U)>uj*{U)- (10) 

Next, by manipulating the link secrecy allocation vector [uji, . . . ,ujk, ■ ■ ■ ,^k], we construct a new link secrecy 
allocation vector that satisfies the equality constraint, while having a cost smaller than C*(n). To this end, consider 
some arbitrary link £yfc, and replace io^ by a new w^ as follows 

^k = ^k- (11) 



Since u* < oj, it follows that uj'^ < ujk- Consequently, the new cost of the link ^^ with link secrecy 

C{ik), which in turn indicates that the new path cost with secrecy allocation vector [uji, . . . ,a;^, . . . ,ujk] is less 

than C(n). Therefore, we have 

C'{U)<C(U) <C*{U), (12) 

and, 

uj{U)>uj'{U)=uj*{U)- (13) 

The proof follows by noting that this contradicts the assumption that C*(n) is the minimum cost of path 11 with 
the equality constraint. ■ 

Thus, to minimize the cost of the optimal route, the inequality constraint can be substituted by the equality 
constraint H^ en(l ~ ""^fc) = 1 — ^- On each link £k, it is desirable to keep the successful eavesdropping probability 
vTfc close to 0. In this case, the product fie eui^ ~ ^fc) ^^"^ ^^ approximated by the expression 1 — ^^ gn^fe- ^y 
substituting the approximate linearized constraint in the routing problem, the following optimization problem is 
obtained 

n* = argmin N^ C(£fc) 

s.t. 2^7rfc=7r- 

In the rest of the paper, we focus on this optimization problem. We first show that the problem is, in general, 
NP-hard and then develop exact and approximate algorithms to solve it. 

III. Secure Link Cost 

The link cost is composed of two components: (1) the source power, and (2) the jammers' power. Let C(£fc) 
denote the cost of link f^ = {Sk,Dj.,£k,Jj.) under the constraint of eavesdropping probability tt^. Then, C{ik) is 
given by: 

C{ik) = PP + Pf\ (15) 

where Po and P) denote, respectively, the average source and jammers power on link £fc. In the following 

ik] (k) 

subsections, we will compute the optimal values of Pg and Pj subject to a given tt^. 

A. Source Transmission Power 

Assume that the (complex) fading channel coefficient hs^^Dk is known at the source Sk of the given link ij^. 
Because we are trying to maintain a fixed rate (and, hence, a fixed received power), the source will attempt to 
invert the channel using power control. However, for a Rayleigh frequency-nonselective fading channel, as assumed 
here, the expected required power for such an inversion goes to infinity, and, hence truncated channel inversion is 
employed [25, Pg. 112]. In truncated channel inversion, the source maintains the required link quality except for 
extremely bad fades, where the link goes into outage. When a link is in a bad fade, the source will need to wait 
until the link improves before transmitting the packet and delay will be incurred. To limit the delay, we maintain a 
given outage probability p per link. Then, for a given packet, we need to transmit at rate R = A/(l — p) to maintain 
the desired goodput A. Associated with that rate R is the SINR threshold 7/5 = 2^ — 1 required for successful 
reception at the link destination [24 1. 

Let Pg denote the average transmission power of Sk, and let Pg \\hsk,Dk\'^) denote the power used for a 
given packet as a function of the power |/iSfc,DfcP in the fading channel between Sk and Dk- Per above, below 
some threshold r, the source will wait for a better channel. From the Rayleigh fading model employed, \hs^^Dk\'^ 
is exponential with parameter l/fi^ £, ', hence, r = — ln(l — p) ■ dg jj and truncated channel inversion yields: 

lO, \hs„DA <r 



Then, the average power employed on the link is given by: 



Pi'^ = rr^ r^- d% n. e'^dx 



^ l-pJr X ^'"^■ 

= iDkpd^^^^, ^ (17) 

where kp is a constant that depends on the parameter p. Hence, for a fixed network parameter p (which also 
determines 7d), the average power consumed on a given link ik to achieve the secure goodput A is proportional 

B. Jammers' Transmission Power 

Our physical layer security primitive described in Section |II] can provide security only against a single eaves- 
dropper at a fixed location. To achieve security in the presence of multiple eavesdroppers or uncertainty about the 
location of eavesdroppers, we utilize random linear coding on each link. 

Consider link Ik between transmitter Sk and receiver D^ with the associated set of potential eavesdropping 
locations S^ = {^Ei, . . . , E\£\^ . Transmitter S^ performs coding over \£k\ messages accumulated in its buffer 
for transmission to D^- To generate a coded message, 5*^ selects a random subset of the messages in its buffer 
and adds them together (module- 2). To recover the original messages, the receiver needs to collect \£k\ linearly 
independent coded messages. In order to transmit only linearly independent coded messages, S^ keeps track of the 
coded messages it has transmitted so far. Let nii denote the i-th coded message that is being transmitted to D^- 
To securely transmit rrij, 5*^ employs the cooperative jamming primitive of Section |II] assuming that there is an 
eavesdropper in location Ei. Since each coded message is hidden from at least one eavesdropping location, it is 
guaranteed that an eavesdropper located at location Ei, for all E-i G 8^, will not be able to obtain any information 
about the original messages. 

In the following subsections, we compute the optimal jamming power per link. The derivation for the case of 
multiple eavesdroppers relies on the jamming power computed for the single eavesdropper case. 

1) Single Eavesdropper: Because slow frequency non-selective fading is assumed and the channel to the eaves- 
dropper is unknown, there is some probability that the eavesdropper will obtain the message by achieving a received 
SINR greater than a threshold ^e- Let T^k{\hsk,Dk\^) denote the probability the eavesdropper achieves SINR greater 
than threshold ^e for a given source to destination channel hs^,Dk (recall that the source power will fluctuate as 
hSk,Dk fluctuates, and this will impact the interception probability at the eavesdropper). Because we want to avoid 
placing limitations on the capabilities of the eavesdropper, assume that the eavesdropper receiver is noiseless. Let 
Pj and Pj (|/i5fc,DfcP) denote the average and instantaneous transmission power allocated to jammers in J^, 
respectively. Then, using dU, it is obtained that 

T^k{\hSk,DA'^) = r-rfS ^ 77T 

Now, to maintain a given tt^, it is sufficient to maintain TTk{\hSk,Dk\'^) = T^k across all |/iSfc,DfcP- Under this 
condition, recognizing that both Pg {\hsk,Dk\^) and Pj {\hsk,Dk\^) are proportional to \hsk^Dk\^, we have: 

p(fc)n, |2n {l/^k-l)Pf\\hsk,Dk?) 

Pj '{\hs„Dj ) = — 7^1 r^, (18) 

and, taking expectations yields 

p(fc) _ V^fc - 1 p(fc) n ON 



Other forms of coding, such as dividing each message to smaller chunks 1321 . can be equally incorporated in our algorithm. 



and, 



TTfc = 3S TT • (20) 



J 



2j Multiple Eavesdroppers: Recall that our objective is to compute the minimum jamming power for the link. 
Let TTj^{i) denote the successful eavesdropping probability on link if^ conditioned on having an eavesdropper at 
location Ei. The unconditional eavesdropping probability vr^ on link i^ is then given by the approximate relation 
TTfc = X]_E e£ Pk{Ei) ■ vrfc(i), where pk{Ei) is the probability of having an eavesdropper at location Ei. Since 
jamming power depends on the location of the eavesdroppers, by optimally allocating jamming power to each 
potential eavesdropping location, we can minimize the total jamming power across all eavesdropping locations for 
a given link. 

The minimum jamming power for link l^ over all eavesdropping locations £k is given by the solution of the 
following optimization problem: 

mm " •-'•^ ' I 



Pf'ii) 



E^i 



E^. (21) 

S.t. 2_^ Pk{Ei) ■ TTkii) = VTfc, 

E,eSk 

where Pj (i) = J2j eJk ^i (^) ^^ ^^^ jamming power conditioned on the eavesdropping location Ei, i.e., the 
jamming power during the transmission of the coded message rrii. Define (pkii) as follows 

After substituting for TTk{i) using (l20b . we obtain the following optimization problem: 

mill > Pj (i) 

Pk{Ei) (2^^ 



E,&Ek 



l + Mi)Pf'^ii) 



The optimization variables in this optimization problem are the jamming powers Pj {€). The Lagrangian for the 
link cost optimization problem is expressed as follows 

L{pf\l),...,pf\\£k\lv) 



/ v^ PkiEi) 

vr 






Epfw + - E 



E,6£. £,6£. l + *UOPr(') 

Using the Lagrange multipliers technique, it is obtained that 



dL ^ ^ _ ^, Mi)Pk{E,) ^24) 

5Pf (0 {l + Mi)Pf\iW^ 



and, 

dL y-^ pk{E, 



Using (l24l ). we have 






Pk{Ei) \/pk{Ei) 



By substituting in (l25l) . it follows that 



(26) 



EiMt-. 



B,6£. V ''*'=('■) 
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(28) 



vrfc(2) = -— 7TT p===7rfc, (29) 



and, therefore, 



It is then obtained that 



and. 

For a given Unk ^^ and eavesdropping probabiUty vTfc, we can use (l30l ) to compute the optimal jamming power 
allocation for each coded message mi. Consequently, the average jamming power per message on link ^^ is given 
by: 



(31) 




p(fe) _ 


1 1 /^ 


:) 




= 




- ' y ' ■ 



C. Discussion 

1) Colluding Eavesdroppers: While we considered the case of non-colluding eavesdroppers here, our model can 
be extended to handle colluding eavesdroppers by requiring that at least of the coded messages be protected against 
all eavesdroppers. Let £k = {Ei, . . . ,E\£^\^ denote the set of colluding eavesdroppers. Assume that on link ik, 
Bj^ messages are coded together for transmission, i.e., B^ is the length of the coding block. Then, the probability 
that a coded message m is captured by all eavesdroppers is given by He ef "^fcl^)- Thus, the probability that at 
least one message out of the Bf^ coded messages is not received by all eavesdroppers is given by 

l-( n Mi))"""- (32) 

To satisfy the link eavesdropping constraint vr^, the following relation should be satisfied 

l-( n Mi)Y' =^k, (33) 

E,e£k 

which yields 

n Mi)= "V^- (34) 

E.eSk 

This constraint can be used in the optimization problem (l23T l to compute the optimal link cost for the case of 
colluding eavesdroppers. 

An interesting observation is that 

lim TTkii) = 1, for all Ei E £k- (35) 

Bfc— s-oo 

That is, by increasing the length of the coding block, the link cost can be significantly reduced. The cost to be 
paid is in terms of increased transmission delay. 

2) End-to-End Coding: Rather than looking at individual links in isolation and then performing hop-by-hop 
coding, we can perform coding on an end-to-end basis only at the source node. Then by repeatedly finding paths 
that are secure against single eavesdropping per link, the source can securely communicate with the destination 
through multiple paths. This approach is appropriate if there are only a few potential eavesdropping locations in the 
network. If the maximum number of eavesdropping locations per link is m, then the running time of this approach 
is m times that of the routing algorithm with single eavesdropping location per link. 
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IV. Secure Path Cost 

In this section, using the Unk cost formulation of the previous section, we formulate the optimal cost of a given 
path n subject to an end-to-end eavesdropping probability vr. The problem essentially is to divide -k across the 
links forming 11 so that the path cost is minimized. 

A. Optimal Path Cost 

Consider a given path 11. We find the optimal cost of path 11 by solving the optimization problem (IT4] |. Consider 
link £fc G 11, where if^ = {Sk,Dh,8k,Jk)- Define x^ and y^ as follows: 



1 v^ Pk{Ei 



1^.1 i:^e^ V '^^^) 

and. 

Using the results obtained in the previous subsection, the following relation holds: 

xl 

Vk + Pj 

By substituting the above expressions in the optimal routing formulation described in (IT4l i. the following optimization 
problem is obtained for minimizing the cost C(n) of route 11: 



mill V P^^ + P) 



^2 . (36) 



4 en Vk + -Tj 

The optimization variables in this optimization problem are jamming powers Pj . The Lagrangian for the routing 
optimization problem is expressed as follows 



ik&n ^fcGH Vk + ^J 



vr 



Using the Lagrange multipliers technique, it is obtained that 



and. 



Using (1371) . we have 



- 1 - 1^ '-j^, (37) 

4 en Uk + ^j 



Xk 



By substituting in (1381) . it follows that 



and, therefore. 



Vk + Pf^ ^ 

Xk 



(39) 



E^-, (40) 



4e£ 

1 _ TT 



(41) 



12 



After substitution in (1391 ). the following relation for the optimal eavesdropping probability vr^ on link f^ is obtained 

7rfc = ^^^^ vr- (42) 



For a given route 11 and end-to-end eavesdropping probability vr, we can use (I42b to divide vr between links ^,fc G 11. 
Having computed vr^, the optimal power allocated to jammers on link i^ is given by the following expression: 

^j''^ = --Xky^Xi-yk- (43) 

(k) 

Using the above expression for Pj , the cost of link ik G H is expressed as 

C(4) = {(iskp) • dX,D, -yk) + - {xk Yl ^0 • (44) 



,Gn 



Consequently, the cost of secure route 11 is given by: 

C{U) = Y^ {{^skp) ■ (ig„B, - 2/fc) + ^( E ^fc)' • (45) 

To this end, for a given route 11 between the source and destination, the optimal cost of 11 subject to the end-to-end 
eavesdropping constraint vr is given by (l45l ). The optimal cost is achieved by allocating P^ and Pj to each link 
^fc G n using ([TT] ) and (1431 ). respectively. Such a power allocation scheme would result in minimum cost, while 
guaranteeing that the eavesdropping constraint would be satisfied. Thus, SMER is reduced to finding a path, among 
all possible paths between the source and destination, that minimizes the optimal path cost ( [451 ). The following 
proposition formally states this result. 

Proposition 1: SMER with end-to-end eavesdropping and goodput constraint tt and A, respectively, is equivalent 
to finding a path that minimizes the optimal path cost C(n) as given by ( |45l) . 

B. Optimal Path Cost Structure 

Define Ci{£k) and C2{C-k) as follows: 



Ci(4) = {lskp)-d%n, -Vk 







21 



T^-E^^- 



(46) 



en 



Then the optimal path cost (1451) can be expressed as 

c(n) = Y Ci(^fe) + ( E ^2(4))'- (47) 



4 en 4 en 

It is important to note that, while the Ci(£fc)'s may assume negative values, the path cost structure in WT\ is 
monotonous in the number of links, i.e., if a path IT is a subset of a path 11, then Cijl) < C(n). This is because 
TT < 1, and it can be shown that ( X^^^en ^k) > Zl^fcen Vk- Consequently, (|47] ) is minimized by a simple path. 

V. Secure Minimum Energy Routing 

In this section, we investigate the secure minimum energy routing problem, where the cost of a path is given 
by (l45l) . We begin by establishing that it is NP-hard. Then, by exploiting the structure of the optimal solution, we 
employ dynamic programming to obtain a pseudo-polynomial time algorithm that provides an exact solution. This 
means that the problem is weakly NP-hard |[331 . thus fully polynomial time approximate schemes are possible. 
Accordingly, we conclude the section by presenting a fully polynomial time e-approximation algorithm for the 
problem, which takes an approximation parameter e > and after running for time polynomial in the size of the 
network and in 1/e, it returns a path whose cost is at most (1 + e) times more than the optimal value. 
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A. Computational Complexity 

We first show that our routing problem is NP-hard via a reduction from the partition problem. 

Theorem 1: Problem SMER is NP-hard. 

Proof: We describe a polynomial time reduction of the Partition problem fyi\ to SMER. Given a set of integers 
S = {ki, k2, ■ ■ ■ , kn}, with X]r=i ^j = 2 • K, the Partition problem is to decide whether there is a subset S' of S 
such that J2ieS' ^« ~ ^■ 

Given an instance S = {ki,k2T ■ ■ ,kn} of the Partition problem, with J27=i^i ~ 2 • -R', we construct the 
following network. The set of nodes is identical to S. For i = 1 to n — 1, we interconnect node ki to node fcj+i 
with two links, as follows: an "upper" link £ , to which we assign Ci(^j ) = 2 ■ K ■ ki and C2{if' ) = 0, and a 
"lower" link if"\ to which we assign Ci{£f"') = and €2(1'^^) = h. 

Lemma 2: The answer to the Partition problem is affirmative ijft\\e solution to SMER in the constructed network, 
i.e., the minimum value of (|47|) of a path between nodes ki and A;„, equals 3 • K^. 

Proof: A path H between nodes ki and fc„ consists of a (possibly empty) set of "upper" links U and a (possibly 
empty) set of "lower" links W. Let Su and S^ be, correspondingly, the sets of indices of the links in U and in W, 
i.e., ieSuiff 4"'' ^UdinAieSyj iff if'^ G W. Clearly, 5« U 5^„ = S. The cost of the path, per (gT]), is given by: 



c(n)= Y. Ci(4"V E Ci(4'"^) 



(48) 

= E ( 2 • ^ • ^. ) + E + ( E + E ^* 

Consider first the case X]je5 ^« — X]je5 ^«- Since X^ieS ^« + Sie5 h = 2 ■ K, denote: J2ieS ^* = i^ + (5, 
SieS ki = K — 6, for some (5 > 0. Then, from (1481 ). we have: 

c(n) = 2 • i^ • (is: + 5) + (i^ - 5) =3-K^ + 6'^- 



Consider now the case X]je<s ^i ^ Sig5 ^*- ^^ follows similarly that 

C(n) = 3-K^ + 6^- 

We conclude that the length of a path between nodes ki and A;„ is at least 3 • K^, and, furthermore, that value is 

attained iff the set S can be partitioned into two subsets Su and S^, such that J2ies ^« ~ SiG5 ^«' '•^•' 'j^'^^'^'"^ 

is a subset S' = Su oi S such that X]ig5' ^i — -^' ^'i^ '^'^^ lemma follows. ■ 

Since the Partition problem is NP-complete Il33l . the theorem follows. ■ 

B. Pseudo-Polynomial Time Exact Algorithm 

First, scale the values of the €2(1)' & for any link £ in the network so that they are all integersO Let B denote an 
upper-bound on the sum of the C2(£)'s on any simple path. A trivial bound is given hy B = {N — 1) • C^"^, where 
N is the number of nodes in the network and C2^"^ is the maximum value of C2(i) among all network links. In a 
network with N nodes, C™"^ can be computed in 0{N'^) time via a brute-force search. 

Our algorithm, termed DP-SMER, is Usted below. DP-SMER iterates over all values of C2{i), i.e., C2{i) = 
1,2, ... ,B, and for each value of C2{i), it minimizes ^ Ci{£). Upon return, the algorithm returns the cost of the 
optimal path from source s to destination d along with the structure 11 that contains the network nodes that form 
the path. 

Theorem 2: DP-SMER runs in time 0{N'^-B), where A^ is the number of nodes in the network. Upon completion, 
the algorithm returns an optimal solution to Problem SMER. 

Proof: The first claim follows by noting that the computational complexity is dominated by an iteration on all 
values 1,2, ... ,B, and for each such iteration, iterating on all pairs of nodes. 

''The value of "1" is determined by tlie precision at which we compute C2(i?)'s. 
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Algorithm 1 DP-SMER (source s, dest. d, network Af). 



/* path cost from s to itself is always */ 
tor b = l^ B do 

Cs{h) = 
/* initial path cost from s to any other node is infinite */ 
for all Ui ^ J\f, Ui^ s do 
for 6 = 1 ^ B do 
Q(6)=oo 
for 6 = 1 ^ S do 

/* all node pairs can form a link and be neighbors */ 
for all nj G 7\A do 
for all rij e 7\A do 

/* update path cost via the neighboring nodes */ 
if 6 + C2(£y) < -B then 

\lt<Cj{b + C2{lij)) then 

nj(6 + C2{hj)) = i I* set rij's parent to ni */ 
Cj{h + C2{iij)) = t I* update path cost */ 
/* include the "&" component, i.e., C2, in the path costs */ 
for 6 = 1 ^ S do 

Cdib) = Cd{h) + 62 
/* choose the best value for reaching the destination */ 
h* = arg mill (7^(6) 

return [Q(6*),n(6*)] 



We turn to consider the second claim. First, it can be established, by induction on the values of b, that, upon 
completion of the 6-th iteration of the main loop of the algorithm, for all nodes ni, Ci{b) is the length of a shortest 
path with respect to the metric of the Ci{iij) values, among all paths between the source s and node n^, whose 
length with respect to the metric of the C2{iij) values is precisely 60 Furthermore, it is easy to verify that the 
values of CN{b), computed at the next step of the algorithm, stand for the lengths of the above shortest paths with 
respect to the metric considered by Problem SMER. 

Now, let n* be an optimal solution {i.e., a path) to Problem SMER, and denote by C* its length with respect to 
the metric considered by SMER. Furthermore, denote 6* = X]^ en* ^^i^ij)- It is easy to verify that H* is a shortest 
path with respect to the metric of the Ci{£ij) values, among all paths between the source s and the destination d, 
whose length with respect to the metric of the C2(tij) values is precisely 6*. Therefore, upon completion of the 
above steps of the algorithm, we will have Cn (6* ) = C* ; moreover, since 11* is an optimal solution to SMER, it 
must hold that Cj\f{b*) < C^ib) for all values of 6. The theorem follows. ■ 

C. Fully Polynomial Time e-Approximation 

As in the previous section, we scale the values of the C2(^)'s for any link i in the network so that they are all 
integers and denote by B an upper-bound on the sum of the C2 {£) 's on any simple path. 

The above pseudo-polynomial solution indicates that SMER is only weakly NP-hard (see ISBl ). which enables 
us to apply efficient, e-optimal approximation schemes of polynomial time complexity, similar to the case of the 
widely investigated Restricted Shortest Path problem (RSP, see, e.g., fM\ and references therein). The RSP problem 
considers a network where each link has two metrics, say "cost" and "delay", and some "bound" on the end-to- 
end delay. Then, for a given source-destination pair, the problem is to find a path of minimum cost among those 

^We note that this shortest path may be non-simple, i.e., include loops, due to the potentially negative values of Ci(^ij)'s; nonetheless, it 
is a finite path, and, furthermore, the optimal path returned by the last step of DP-SMER is guaranteed to be simple, due to the monotonicity 
property explained at the end of Section II VI 
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whose delay do not exceed the delay bound. This weakly NP-hard problem admits efficient e-optimal approximation 
schemes of polynomial complexity, e.g., |34|. 

We turn to specify our approximation scheme for Problem SMER by a simple employment of any solution to 
the RSP problemO First, a technical difficulty arises in applying RSP approximation schemes to Problem SMER. 
Recall that while link costs as given by (l44l) are non-negative, Ci{i) can be negative for some links £. In RSP, 
specifically in the approximation scheme of [34], it is assumed that link costs are non-negative. Nevertheless, we 
show that the original network with possibly negative link weights can be safely transformed (i.e., without affecting 
the identity of the solution) to an expanded network with non-negative link weights, by employing the following 
pre-processing step: 

Algorithm 2 Expand_Network (source s, network J\f). 

1) Add the source node s to the expanded network. 

2) For each node u {u ^ s) in the original network, add A^ — 1 replicas denoted by u(l), n(2), . . . , u{N — 1) 
to the expanded network. 

3) For each link isu from node s to node u in the original network, add a link from node s to node u{l) in the 
expanded network with the same metrics as for the original link. 

4) For each link l^v in the original network, where u ^ s,u ^ d,v ^ s, and for each h = \, . . . ,N — 2, add a 
link between node u{h) and node v{h + 1) in the expanded network with the same metrics as for the original 
link. 

5) For each link I in the expanded network, add some (identical to all links) bias 5 > to each link cost Ci{t) 
so that the new link costs would be non-negative. 

The following lemmas establish the relation between the shortest paths in the original network and the shortest 
paths in the expanded network. 

Lemma 3: A path that is shortest w.r.t. the biased metric {Ci{£) + 6) among those that obey a bound on the 
^C2(^) and have precisely h hops, is also shortest w.r.t. the unbiased metric Ci{£) among those that obey the same 
bound on '^C2{i) and have precisely h hops. 

Proof: Suppose that this is not true. That is, there are paths 11 and 11', both obeying the bound on J2^2{£) 
and with h hops, in such a way that 11' is a shortest path with the bias yet 11 is shorter without the bias. Therefore, 
Z]^Gn'^i(^) < Z]^Gn'*^i(^)' y^"^ Z]£Gn('^i(^)+'^) — X]^Gn'('^i(^)+'^)- ^^'^wever, the second inequality can be rewrit- 
ten as: 
Xl^Gn^il^) + h ■ 6 > XlfGH' ^i(^) + h ■ 6, which contradicts the first inequality. ■ 

Lemma 4: A shortest path from source s to node d(h) in the expanded network has precisely h hops. 

Proof: The proof follows from the fact that the i-th hop on the shortest path from s to d{h) has to go from 
some node v{i — 1) to some node u{i) (see the network expansion procedure). ■ 

Thus, to compute an e-optimal solution to Problem SMER, for every bound on Yl,^'i{^)' ^^ ^^^ ^^ shortest 
path with h = 1, . . . ,N — 1 hops in the expanded network by repeatedly employing an approximation solution to 
the RSP problem. For a given approximation value e > 0, let ry = e/3. Furthermore, let L be the smallest integer 
for which [(1 + 77)^] > B. Our algorithm, called e-SMER, is listed below. In this algorithm, e-RSP refers to an 
e-optimal approximation solution for the RSP problem. 

In the e-SMER algorithm, for each considered delay bound [(1 + r/)'], A^ — 1 instances of the approximation 
solution to the RSP problem, for the same bound, are run on the expanded network: in each instance h, we consider 
s to be the source and d{h) to be the destination. Using Lemma |4l it is straightforward to verify that, in each 
instance h, the RSP approximation obtains a solution that satisfies the required delay bound with the restriction 
that the path has precisely h hops (in both the expanded and the original network). 

Therefore, per considered bound on the C2{C.) metric and per possible number of hops up to A^ — 1, we get an 
e-optimal path with respect to the original metric Ci{i) (of precisely that many hops). It follows from Lemmas |3] 
and m that, by comparing all solutions (for all considered bounds on the C2{t) metric and number of hops h), 
we will find a shortest e-optimal path that corresponds to an e-optimal solution to SMER. This is established next 
through the following lemmas and theorem. 

^Other solutions, of reduced computational complexity, can be established, yet their structure is somewhat more complex. 



16 



Algorithm 3 e-SMER (error e, source s, dest. d, net. Af). 



Mx - Expand_Network(s, M) 
for all i e Mx do 

cost{e) = Ci{i) 

delay{i) = C2H) 
for / = 1 — ^ L do 

delay_bound = \{1 + r/)'] 

/* compute the approximate h-hop path */ 

for /i = 1 ^ A^ - 1 do 

[C{l,h),U{l,h)] = e-RSP(e,s,(i(/i),A4) 
/* compute the actual cost as per SMER metric */ 
C{l,h) = {C{l,h) - h ■ 6) + \{1 + tjY]^ 
I* choose the best / and h for reaching the destination */ 
(r,/i*) =argmin(7(/,/i) 

l,h 

return [C{l\h*),Ii{l\h*)] 



Lemma 5: Let E* be an optimal solution (path) to SMER. Denote by C(n*) and C(n), the costs, per the SMER 
metric, of the optimal solution and of the solution obtained by e-SMER, coiTcspondingly. Then: 

C(n) < (l + e)-C(n*)- (49) 

Proof: Let I be the smallest integer such that 

(j;c2(^))'<(r(i+^)'i)'- (50) 

^en- 
Note that this implies that: 

[l + r,f(Y^C2{^)f>(\[l + ^f\f. (51) 



^en- 
Let h be the number of hops of 11*. By construction, Ii(l,h) is an e-optimal approximation for RSP, for "costs" 
Ci(^), "delays" C2(^), "delay bound" [(1 + 7/)'] and precisely h hops. Moreover, by (l50l) . the path 11* obeys this 
bound. Therefore: 

Y, Ci{i)+h-5<{l + e)Y,Ci{^)+h-5, (52) 

f.&i{T,h) ten* 

or, equivalently, 

E Ci(£)<(l + e) J]Ci(^)- (53) 

e(m{i,h) ten* 

Since Ii(l, h) obeys the "delay bound" [(1 + r/)'], we have: 

( Y. C2{l)f < [\{l + r,f\f ■ (54) 

l&l{l,h) 

Combining dSj]), dSS]) and ^^, we have: 

c(n) <c(n(/",/i)) 

< (1 + e) j; Ci(£) + {l + r,f[ Y. C2W)'> ^^^^ 

£en* ten* 

where the first transition is due to the way that 11 is chosen. Since r/ = |, for small values of e (precisely, e < 3), 
(l55l) impUes: 

C(fl)<(l + e)-C(n*), (56) 
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as required. ■ 

Lemma 6: The computational complexity of e-SMER is 0{A ■ ^ ■ log{B) ■ N^), where 0{A) is the computational 
complexity of the employed approximation scheme for RSP. 

Proof: Let M be the number of links in the original network. Each time we employ the RSP approximation 
scheme, we would incur a computational complexity of 0{A), where A corresponds to a network with N nodes 
and M links. 

For each value of / = 1 . . . , L, we call the RSP approximation as follows: once for a network with A^ nodes 
and 0{N) links {i.e., for the network that contains s and all the u(l)'s), once for a network with roughly 2N 
nodes and M links (i.e., for the network that contains, in addition to the above, all the u(2)'s and links of the 
form {u{l),v{2)), once for a network with roughly 3A^ nodes and 2Af links (i.e., for the network that contains, in 
addition to the above, all the n(3)'s and links of the form {u{2),v{3)), and so on up to, once (the (A^ — l)-th time) 
for a network with roughly (A^ — 1)A^ nodes and {N — 2)M links. The above A^ — 1 instances (more precisely, all 
but the first, which can be neglected due to smaller complexity) aggregate to: 

0(A • (2 • 1 + 3 • 2 + • • • + A^ • (A^ - 1))) 

^-'^ (57) 

= 0{A-^i{i + l))=0{A-N'^)- 

i=l 

The proof follows by noting that L = 0{- ■ log{B)). ■ 

Theorem 3: e-SMER is an e-optimal approximation scheme of polynomial complexity. In particular, when 

employing the approximation solution of [34] to the RSP problem, e-SMER runs in 0(A^^-(loglog A^+i)-i-log(i?)) 

time. 

Proof: The RSP scheme of [34] has computational complexity of 0[{N • M • (log log A^ + 1/e)) for A^ nodes 

and M links. Depending on the limit on the transmission power at each node, in worst-case we have M = 0{N'^), 

i.e., all nodes may be neighbor^ The proof then follows from Lemmas |5]and |6] ■ 

More efficient versions of e-SMER should be possible, yet our goal has been to show that fully polynomial time 

e-approximation schemes (FPTAS) exist for the NP-hard problem SMER. 

D. Distributed Implementation 

While it is not discussed in this paper, our routing algorithms can be implemented in a distributed manner 
following standard techniques of distance- vector routing. Note that the power allocation at the physical layer 
is a local operation performed by the transmitting node of each link based on the information from the routing 
algorithm and topological information (collected, for instance, through neighbor discovery before running the routing 
algorithm). 

VL Simulation Results 

A. Simulation Environment 

We have implemented our routing algorithms in a custom-built simulator to study their performance in a variety 
of network scenarios. We simulate a wireless network, in which nodes are distributed uniformly at random in a 
square of area 5x5 with node density a = 3. We also place a number of eavesdroppers in the network with density 
ge, as described later. We consider one eavesdropper per link. We keep the number of eavesdroppers considerably 
less than that of the legitimate nodes in order to be able to establish secure routes as we put a limit on the maximum 
transmission power of each node. Every node has a maximum transmission power that is set in such a way that the 
resulting network becomes connected (the absolute value of the maximum power does not affect the results). We 
choose two nodes s and d located at the lower left and the upper right corners of the network, respectively, and 
find paths from s to d. We then compute the total amount of energy consumed on each path using different routing 
algorithms. The performance metric "energy savings" refers to the percentage difference between total energy used 
by different algorithms with respect to the benchmark. For simulation purposes, we set vr = 0.1, ue = ^, Nq = 1, 
7£) = 0.8, and 7^; = 0.6, unless otherwise specified. The numbers reported are obtained by averaging over 10 
simulation runs with different seeds. 

^Note that, typically, the network is sparse, i.e., M <^ N^, hence the dependency on A^ is more like A'^^. 
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B. Simulated Algorithms 

In addition to DP-SMER and e-SMER, we have also implemented a security-agnostic algorithm based on 
minimum energy routing as a benchmark to measure energy savings achieved by our algorithms. The bench- 
mark algorithm, called security-agnostic shortest path routing (SASP), is described below. Note that some of the 
optimizations described in Sections HII] and |IV] have been incorporated in SASP, making it a considerably efficient 
benchmark (see Subsection IVI-CI ). 



Algorithm 4 SASP (source s, dest. d, network A/"). 



1) Find a shortest path in terms of transmission power between s and d ignoring eavesdroppers. The standard 
Dijkstra's algorithm can be used for this purpose. 

2) Use (l42l) to allocate an optimal eavesdropping probability to each link of the computed path. 

3) Use (l43l ) to allocate sufficient power to jammers on each link with respect to the allocated eavesdropping 
probabilities in step (2). 



C. Results and Discussion 

Effect of Eavesdropper Location on Link Cost. For a fixed link between two nodes, the source transmission 
power is also fixed as obtained in dTTl ). Thus, the cost of the link depends only on the jamming power which 
is a function of the eavesdropper location as given by (1311 . Fig. [T] shows the cost of establishing a secure link 
between source S (placed at the center) and destination D for different eavesdropper locations and vr = 0.001. In 
the figure, the color intensity at each point is proportional to the amount of energy required to establish the link 
if the eavesdropper is placed at that point. Clearly, by some maneuvering around an eavesdropper, a significant 
reduction in energy cost can be achieved as the eavesdropper becomes almost ineffective in some locations. This 
is the main idea behind this work. 
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Fig. 1 : Effect of eavesdropper location on Mnk cost. 



Effect of Optimal Secrecy Allocation on Path Cost. For a fixed path subject to an end-to-end secrecy requirement 
vr, the optimal eavesdropping probability assigned to each link of the path is given by (l42l) . which in turn determines 
the optimal jamming power allocated to each link of the path using (1431 ). Specifically, this is how power allocation 
is performed in SASP in order to minimize power consumption. Alternatively, a simple heuristic is to divide vr 
equally across the links. That is, if the path contains h links, then each link if. is allocated sufficient jamming 
power to satisfy the eavesdropping probability vrfc = vr//i. In Fig. |2l we have depicted energy savings that can be 
achieved "solely" by optimal secrecy allocation compared to equal allocation for a fixed path that is computed by 
SASP. Interestingly, as the number of eavesdroppers increases or the signal propagation becomes more restricted, 
optimal secrecy allocation becomes even more important, achieving energy savings of up to 72% (47%) for a = 4 
(a = 2) in the simulated network. 
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Fig. 2: Energy savings achieved by optimal secrecy allocation. 



Non-uniform Eavesdropper Placement. To gain more insight about the behavior of different routing algorithms, 
in this experiment, rather than randomly distributing eavesdroppers in the network, we strategically place them 
close to the line that connects the source and destination. Ideally, SMER and e-SMER should avoid the shortest 
path that crosses the network diagonally. This is indeed the behavior observed in the simulations as depicted in 
Fig- 13 ('•' denotes an eavesdropper). As expected, SASP blasts right through the eavesdroppers, while SMER, 
0.1-SMER and 1.0-SMER route around them resulting in 88%, 86% and 85% energy savings, respectively. 




-□-DP-SMER 
-0-0.1 -SMER 
1.0-SMER 
-O-SASP 



12 3 4 5 

Fig. 3: Snapshot of paths computed by different algorithms. 



Uniform Eavesdropper Placement. In this experiment, eavesdroppers are placed in the network uniformly at 
random. As seen in Fig. |4l our algorithms consistently outperform SASP for a wide range of eavesdropper densities 
and eavesdropping probabilities. In particular, energy savings of up to 99% and 98% (for a = 4) can be achieved 
by SMER and 0.1-SMER, respectively. 

Effect of Network Size. Fig. [5] shows the energy savings achieved by different algorithms in networks with varying 
sizes. The "network dimension" refers to the length of one side of the square area that contains the network nodes. 
As observed from the figure, the energy saving is an increasing function of the network size. Interestingly, as the 
network size increases, the effect of the propagation environment diminishes in such a way that energy savings for 
a = 2 and a = 4 converge to the same numbers as opposed to the previous scenarios. As the network size increases 
so does the average length of the path (in terms of the number of hops) between the source and destination nodes. 
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Fig. 4: Energy savings with uniform eavesdropper placement. 



Those paths that are longer provide more opportunities for energy savings on each link of the path resulting in 
increased overall energy savings. This effect works in favor of a = 2 as well as a = 4. However, given the high 
values of energy savings for a = 4 (due to longer paths compared to a = 2), the effect of longer paths is more 
prominent for a = 2. 
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Fig. 5: Effect of network size on energy savings. 

Effect of Jamming Set. The cardinality of the jamming set affects the power allocation to jammers. In this 
experiment, we change the number of jammers that participate in secure transmissions on each link and compute 
the energy savings achieved by different algorithms. Figs. | 0a)| and | 0b)[ respectively, show the energy savings 
achieved for non-unform and uniform placement of eavesdroppers. Interestingly, in these scenarios, a small number 
of jammers, namely 2, is sufficient to obtain most of the benefits of cooperative jamming, which should greatly 
simplify any practical implementation. 



VII. Related Work 

A survey of prior work is presented in this section. 

Secure Routing in Multi-hop Networks. While there are numerous works on secure routing in wireless networks 
(see, e.g., I35l and references therein), their focus is on preventing maUcious attacks that disrupt the operation of 



21 



lOQ 



95 



^ 



e 

c 
W 



?(S 



85 



80 



75 



70. 



=€t= 



n- 
A- 



=^t= 



-n- 
-A- 



=^= 



-D 

-A 



S 



-D-DP-SMER, a=4 
-A-O.l-SMER, a=4 
■D-DP-SMER, a=2 
A 0.1-SMER, a=2 



3 4 5 

Number of jammers 

(a) Non-uniform eavesdrop, placement. 



100 



it 



^ 



e 
■> 

c 

W 



95 



90 



t 



85 
80 
75- 
70- 



=0^ 



D- 
A- 



=^t= 



=^t= 



i 



-□- 
-A- 



-D 

-A-- 



i 



-n-DP-SMER, a=4 
-A-O.l-SMER, a=4 
-n-DP-SMER, a=2 
A 0.1-SMER, a=2 



3 4 5 

Number of jammers 

(b) Uniform eavesdrop, placement. 



Fig. 6: Effect of the jamming set on energy savings. 



the routing protocol using application level mechanisms such as authentication and cryptography. The focus of this 
paper, on the other hand, is on secure transmission of messages via the most cost-effective paths in the network, 
which is orthogonal to the secure routing problem considered in the existing literature. 

Wireless Physical Layer Security. The idea behind physical layer security is to exploit the characteristics of 
the wireless channel such as fading to provide secure wireless communications. The foundations of information 
theoretic security, which is the theoretical basis for physical layer security, were laid by Wyner and others [4 1-[6] 
based on Shannon's notion of perfect secrecy O. In the classical wiretap model of Wyner, to achieve a strictly 
positive secrecy rate, the legitimate user should have some advantage over the eavesdropper in terms of SNR. Later, 
Maurer fT| proved that even when a legitimate user has a worse channel than an eavesdropper, it is possible to 
have secure communication. While some physical layer security techniques allow for opportunistic exploitation of 
the space/time/user diversity for secret communications ||7l, llH, others actively manipulate the wireless channel 
to block eavesdroppers by employing techniques such as multiple antennas llTI and jamming ifTOl . 11121 . While 
some of these techniques have been successfully implemented in practical systems f^T], physical layer security is 
focused on very special network topologies, e.g., single-hop networks. In this work, we have developed algorithms 
to extend these techniques to multi-hop networks. 

Scaling Laws in Large Secure Networks. Motivated by |36|, recently, throughput scaling versus security tradeoffs 
have been investigated in the context of large wireless networks ||T3l . |[T7l - |[T9l . Specifically, for cooperative 
jamming when the eavesdroppers are uniformly distributed, it was shown that if the number of eavesdroppers 
grows sub-Unearly with respect to the number of legitimate nodes, a positive throughput for secure communication 
is achievable lfT3l . 

Security Based on Network Topology. When there is sufficient path diversity in a network, different messages can 
be routed over different parts of the network in the hope that an eavesdropper would be incapable of capturing all 
messages from across the network. To exploit network diversity for security, various techniques based on multi-path 
routing ||37l . ||38l and network coding ||39l . POl have been investigated. While such techniques are suitable for 
wired networks, their application in wireless networks is challenging due to lack of path diversity at the source or 
destination of a communication session. Moreover, there are considerable complications when splitting a flow among 
several paths, in particular, at the granularity of a single session. Moreover, network topology, in wireless networks, 
is a function of power allocation at the physical-layer and propagation environment, e.g., fading. Nevertheless, our 
approach is complimentary to these techniques, by providing a mechanism to find a minimum cost path that is 
information-theoretic ally secure, regardless of the network diversity. 
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VIII. Conclusion 

This paper studied the problem of secure minimum energy routing in wireless networks. It was shown that while 
the problem is NP-hard, it admits exact pseudo-polynomial and fully polynomial time e-approximation algorithmic 
solutions. Furthermore, using simulations, we showed that our algorithms significantly outperform security-agnostic 
algorithms based on minimum energy routing. Finally, we note that our work can be potentially extended to 
incorporate other secrecy models. Such extensions are left for future work. 
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